Aruba Cloud vs Seeweb

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

IaaS/data-center provider—not a consumer no-logs VPN. Assurance is via ISO/ISMS and sector qualifications rather than a no-logs report.

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

Vendor certifications page: ISO/IEC 27001:2022, AXE REGISTER cert IT18-27702D, valid until 28 Nov 2027; locations Milan & Frosinone. Re-verify serial in procurement.

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

No SOC 2/3 report advertised on the official certifications page at research time.

Certificate/report PDF linked from data-protection resources page.

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

Italian controller/processor entity, European hosting messaging, privacy policy, ISO 27018 claim, CISPE; confirm DPA for your processing roles.

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

Italian Seeweb S.r.l., Italian DHH parent, no known US parent; primary hosting on European DCs (not AWS/GCP/Azure). Third-party Swiss/BG facilities and global transit carriers exist. Indicative only—not legal advice.

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

Art. 28 DPA language used for Seeweb-operated services (e.g. published for Regolo); request current signed DPA + TOMs + subprocessors for core cloud/IaaS contracts.

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Vendor states CISPE registry presence and European data storage under the Code (since 31 May 2017 on certifications page).

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Infrastructure/GPU provider and Rethic.AI partnership messaging; AI Act duties mainly fall on customer AI systems. Not a full provider high-risk AI assessment by EuropeanStack.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

IaaS qualification for Italian PA; QI2 infrastructure and QC2 for listed products including AI/supercomputing infrastructures (19 Jan 2023 on certifications page).

Stated for Virtual Private Cloud and Foundation Server PRO (6 July 2022 on certifications page).

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

Region set is European (IT/CH/BG) with a mid-size operator catalog. Multi-continent apps or niche managed PaaS may force multi-cloud or a larger EU peer.

ISO and ACN claims include certificate numbers and dates on seeweb.it, but EuropeanStack did not re-download every registry PDF. Re-verify serials and scope statements in formal assurance reviews.

Facility partners and network carriers are described on DC pages, but a consolidated customer-content subprocessor list was not found as one public document. Request annex under NDA for regulated workloads.

Vendor documents ~2-minute notice before Spot termination when On-Demand needs capacity. Architect batch/checkpointing; do not run sole critical control planes only on Spot.

Lugano, Zurich, and Sofia are presented via partner facilities (Swisscom, Global Data Centers Switzerland AG, Evolink). Italy-only residency must be contracted explicitly if required.